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FIG. 3 
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FIG. 5A 



finclude "rts.h" 
^include "fta.h" 



/* The FTA references the following internal fens: 

v 

struct count_pkts_ftaj 
struct FTA f; 

i; 

struct count_pkts_tuplej 

struct timeval tuple_varO; 
unsigned int tuple.varl; 

static int free_fta(struct FTA *f) [ 
return 0; 

i 

static int control_fta(struct FTA *f, int command, int sz, void *value) | 
struct count_pkts_fta * t = (struct count_pkts_fta *) f; 

return 0; 

i 

static int accept_packet(struct FTA *f, struct packet *p) | 
/* Variables which are always needed */ 

int retval, tuple_size, tuple_pos; 

struct count_pkts_ tuple *tuple; 

struct count_pkts_fta H = (struct counLpkts.fta*) f; 

/* Variables for unpacking attributes */ 

unsigned int unpack_var_hdr_length_3; 
struct timeval unpack. var_timestamp_3; 
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FIG. 5a (continued) 



/* Unpack the referenced fields */ 

retval = geUpv4_hdr_length(p, &unpack_var_hdr_length_3); 
if(retval) return 0; 

retval = get_timestamp(p, &unpack_var_timestamp_3); 
if(retval) return 0; 



/* Test the predicate */ 

if( !( ( unpack_var_hdrjength_3>50 ) ) ) 
return 0; 

/* Create and post the tuple */ 

tuple_size = sizeof( struct count_pkts_ tuple); 
tuple = allocate_tuple(f,t->f.stream_id, tuple_size ); 
if( tuple == NULL) 
return 0; 

tuple_pos = sizeof( struct count_pkts_ tuple); 
tuple->tuple_varO = unpack_var_timestamp_3; 
tuple- >tuple_var1 = unpack. var_hdr_length_3; 
post_tuple(tuple); 

return 0; 
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FIG. 5B 

562 struct FTA * count_pkts_fta_alloc(unsigned stream, id, unsigned priority, int 

563 argvc, void * argv[] ) \ 

564 struct count_pkts_fta* f; 
565 

566 if( (f=fta_alloc(0,sizeof(struct count. pkts_fta) ) )"0) \ 

567 return(O); 

568 j 
569 

570 f->f.stream_id=stream_id; 

571 f->f.prioritppriority; 

572 f->f.altoc_fta=count_pkts_fto_alloc; 

573 f->f.free_fta=free_fta; 

574 f->f.control_fta=control_fta; 

575 f->f.accept_packet=accept_packet; 
576 

577 return (struct FTA *) f; 

578 1 



FIG. 6 



601 DEFINE | 

602 fta_name 'counLpkts'; 

603 aggregote_slots T; 

604 | 
605 

606 select timebucket, count(*) 

607 from IPV4 p 

608 group by timestamp/5000 AS timebucket 
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FIG. 8A 



jfinclude "rts.h" 
^include "fta.h" 



/* The FTA references the following internal fens: 

Di vid e_ Ti m e va Lint 

v 

static struct timeval Divide_Timeval_Int(struct timeval t, int d) j 
struct timeval r; 
r.tv.sec = t.tv_sec / d; 

r.tv_usec = ( ttv.usec + 1000* (t.tv_sec % d )) / d; 
return(r); 

i 



struct count_pkts_aggr_struct | 
struct timeval gb_varO; 
unsigned int aggr_varO; 
struct count_pkts_aggr_struct *next; 

i; 

struct count_pkts_fta } 
struct FTA f; 

struct count_pkts_aggr_struct *aggr_head; 

int n_aggrs; 

int mox.aggrs; 

struct timeval last_gb_0; 

I; 

struct count_pkts_ tuple j 

struct timeval tuple_var0; 
unsigned int tuple_var1; 

i; 
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FIG. 8A (continued) 



static void fta„aggr_flush(struct FTA *f) j 

struct count_pkts_aggr_struct *curr_aggr, *nexLaggr; 
int tuple. size; 

struct count_pkts_ tuple Huple; 

struct counLpktsJta * t = (struct count_pkts_fta *) f; 

curr.aggr = t->aggr_head; 
while(curr_aggr != NULL) { 

nexLaggr = curr_aggr->next; 
/* Create an output tuple for the aggregate being kicked out */ 

tuple_size = sizeof( struct count_pkts_ tuple); 
tuple = allocate, tuple(f,t->f.stream_id, tuple. size ); 
if( tuple != NULL) j 

tuple_pos = sizeof( struct count_pkts_ tuple); 
tuple->tuple_varO = curr_aggr->gb_var0; 
tuple->tuple_var1 = curr_aggr->aggr_var0; 
posLtupIe(tuple); 

i 

ftc_free(f,curr_aggr); 
curr_aggr = nexLaggr; 

i 

t->n_aggrs = 0; 
t->aggr_head - NULL; 
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FIG. 8B 

static int free_fta(struct FTA *f) j 
fta_aggr_flush( ); 
return 0; 

i 

static int control_fta(struct FTA *f, int command, int sz, void *value) \ 
struct count_pkts_fta * t = (struct count_pkts_fta *) f; 

if(command FTA„COMMAND_FLUSH) 

fta_aggr_flush( ); 
return 0; 

i 

static int accept. packet(struct FTA *f, struct packet *p) \ 
/* Variables which are always needed */ 

int retval, tuple.size, tuple_pos; 
struct count_pkts_tuple *tuple; 
struct count_pkts_fta *t = (struct count_pkts_fta*) f; 

/* Variables for unpacking attributes */ 

struct timeval unpack_var_timestamp_3; 



/* Variables for aggregation */ 

/* Group-by attributes */ 

struct timeval gb_attr_0; 

/* Variables for manipulating the aggregate list */ 

struct count_pkts_aggr_struct *curr_aggr, *prev_aggr; 

/* Unpack the referenced fields */ 

retval = geLtimestamp(p, &unpack_var_timestamp_3); 
if(retval) return 0; 



/* (no predicate to test) */ 
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FIG. 8B (continued) 

/* Search for an aggregate that matches on the group by attributes */ 
gb_attr_0 = Divide_Timeval_Int (unpack_vor_timestamp_3, 5000); 

/* Flush the aggregates if the temporal gb attrs have changed. */ 

if( !( (Comparejimeval (t->last_gb_0, gb_attr_0) == 0) ) ) 
fta_aggr_flush( ); 

curr_aggr = t->aggr_head; prev_aggr = NULL; 
while(curr_aggr != NULL) \ 

if( (Compare_Timeval (gb_attr_0, curr_aggr->gb_varO) == 0) ) 
break; 

if(curr_aggr->next != NULL) 

prev_aggr = curr_aggr; 
curr_aggr = curr_aggr->next; 

I 



AT&T DOCKET NO. 2001-0227 
Serial No. 09/911,989 Filed: July 24, 2001. 
Replacement Sheet 



12/25 

FIG. 8C 

if(curr_aggr != NULL) | 
/* Match found : update in place, move to front */ 

curr_aggr->aggr_var0++; 

if(prev_aggr != NULL) 

prev_aggr->next = curr_aggr->next; 
if(t->aggr_head != curr_aggr) 

curr_aggr->next = t->aggr_head; 
t->aggr_head = curr_aggr; 

|else| 

/* No match found ... */ 

if(t->n_aggrs == t->max_aggrs) { 
/* And the aggregate list is full. Reclaim from the end. */ 

if(prev_aggr != NULL) 

curr_aggr = prev_aggr->next; 
else curr_aggr = t->aggr_head; 
if(prev_aggr != NULL) 

prev_aggr->next = curr_aggr->next; 
if(t->aggr_head != curr_aggr) curr_aggr->next = t->aggr_head; 
t->aggr_head = curr.aggr; 



/* Create an output tuple for the aggregate being kicked out */ 

tuple.size = sizeof( struct count_pkts_ tuple); 
tuple = allocate. tuple(f,t->f. stream. id, tuple_size ); 
if( tuple != NULL) j 

tuple_pos = sizeof( struct count_pkts_ tuple); 

tuple->tuple_var0 = curr_aggr->gb_var0; 

tuple->tuple_var1 = cunLaggr->aggr_varO; 

posLtuple(tuple); 

i 

jelsej 
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FIG. 8C (continued) 
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/* Room in the aggregate list, add another block. */ 

curr_aggr = (struct count_pkts_oggr_struct *) 
fta_alloc(f,sizeof(struct count_pkts_aggr_struct) ); 

if(curr_oggr == NULL) return 0; 

curr_aggr->next = t->aggr_head; 

t->aggr_head = curr_aggr; 

t->n_aggrs++; 



curr_aggr->gb_varO = gb_attr_0; 
curr_aggr->aggr_varO - 1; 



return 0; 
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DEFINE i 

fta_name 'counLpkts'; 
i 

select timestamp, hdrjenqth, count(*), 
sum(offset), max(ttl), min(destlP) 
from IPV4 p 

where ttl in [ 2, 3, 6, 9 ] and 

timestamp > (TIMEVAL 1 123.45') + 
group by timestamp, hdrjength 



5 
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FIG. 10 
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FIG. 11 A 



finclude "rts.h" 
§ include "fta.h" 



/* The FTA references the following internal fens: 

Add_Timeval_Int 
Compare_Timeval 
Subtract_Timeval_Timeval 
TimevaLConstructor 

v 

static struct timeval Add_Timeval_Int(struct timeval t, int inc) j 
struct timeval r; 

r.tv_usec = t.tv_usec + (inc % 1000); 
r.tv_sec = t.tv_sec + inc / 1000; 
if(r.tv_usec > 999) j 

r.tv.usec -= 1000; 

r.tv_sec++; 

i 

i 

static int Compare_Timeval (struct timeval tl, struct timeval t2) | 

return( t1.tv_sec != t2.tv_sec ? tl.tv.sec - t2.tv_sec : t1.tv_usec 
t2.tv_usec ); 

i 

static int Subtroct_Timeval_Timeval (struct timeval tl, struct timeval t2) j 
return(l000* (tl.tv.sec - t2.tv_sec) + (tl.tv.usec - t2.tv_usec) ); 

I 

static struct timeval Timeval_Constructor(int s, int m) \ 
struct timeval r; 
r.tv_sec = s; 
r.tv_usec = m; 
return(r); 

i 



AT&T DOCKET NO. 2001-0227 
Serial No. 09/911,989 Filed: July 24, 2001. 
Replacement Sheet 



16/25 



FIG. 11A (continued) 



struct 



I; 

struct 



count_pkts_aggr_struct \ 
struct timeval gb_var0; 
unsigned int gb_var1; 
unsigned int aggr_var0; 
unsigned int aggr_var1; 
unsigned int aggr_var2; 
unsigned int aggr_var3; 



struct 



i; 



count_pkts_fta \ 
struct FTA f; 

struct count_pkts_aggr_struct *aggr_head; 
int n_aggrs; 
int max_aggrs; 



counLpkts^tuple \ 
struct timeval tuple_varO; 
unsigned int tuple.varl 
unsigned int tuple_var2 
unsigned int tuple_var3 
unsigned int tuple_var4 
unsigned int tuple_var5 
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FIG. 11 B 



static int free_fta(struct FTA *f) | 

struct count_pkts_aggr_struct *curr_nd, *next_nd; 
curr_nd = f->aggr_head; 
while(curr_nd != NULL) j 

nexLnd = curr_nd->next; 

fta_free(f, curr_nd); 

curr.nd = nexLnd; 

i 

return 0; 

i 

static int control_fta(struct FTA *f, int command, int sz, void *value) } 
struct count. pkts_f to * t = (struct count_pkts_fta *) f; 
return 0; 

i 

static int accept_packet(struct FTA *f, struct packet *p) | 
/* Variables which are always needed */ 

int retval, tuple_size f tuple_pos; 

struct count_pkts_ tuple Huple; 

struct count. pkts_fta H = (struct counLpkts.fta*) f; 

/* Variables for unpacking attributes */ 

unsigned int unpack_var„destIP_3; 
unsigned int unpack_var_hdrjength_3; 
unsigned int unpack_var_offset_3; 
struct timeval unpack_var_timestamp_3; 
unsigned int unpack_var_ttL3; 

/* Variables for aggregation */ 

/* Group-by attributes */ 

struct timeval gb_attr_0; 

unsigned int gb_attr_1; 

/* Variables for manipulating the aggregate list */ 

struct count_pkts_aggr_struct *curr_aggr, *prev_aggr; 
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FIG. 11B (continued) 

1138 /* Unpack the referenced fields */ 

1139 retval = get_ipv4_dest_ip(p, &unpack_var_destIP_3); 

1140 if (retval) return 0; 

1141 retval = get_ipv4_hdr_length(p, &unpack_var_hdr_length_3); 

1142 if (retval) return 0; 

1143 retval = get_ipv4_offset(p, &unpack_var_offset_3); 

1144 if (retval) return 0; 

1145 retval = get_timestamp(p, &unpack_var_timestamp_3); 

1146 if(retval) return 0; 

1147 retval = get_ipv4_ttl(p, &unpack_var_ttl_3); 

1148 if(retval) return 0; 
1149 

1150 /* Test predicate */ 

1151 if( !( ( ( ( ( unpack_var_ttl_3 == 2 ) | | ( unpock_vor_ttl_3 == 3 ) | | 

1152 j unpack. var_ttl_3 == 6 ) | | ( unpack. var_ttl_3 == 9 ) ) ) && 

1153 ( Compare. Timeval(unpack_var_timestamp_3, Add_Timeval_Int(Timeval_Constructor(l23, 

1154 450), 5] I ) >0 ) ) ) ) 

1155 return 0: 
1156 
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FIG. 11C 

1101 /* Search for an aggregate that matches on the group by attributes */ 

1102 gb_attr_0 = unpack_var_timestamp_3; 

1103 gb_attr_1 - unpack_var_hdr_length_3; 

1104 curr_aggr = t->oggr_head; prev_aggr = NULL; 

1105 while(curr_aggr != NULL) j 

1106 if( (Compare. Timeval(gb_attr_0, curr_aggr->gb_varO) == 0) && 

1107 (gb_attrj == curr_aggr->gb_var_l) ) 

1108 break; 

1109 if(curr_aggr->next != NULL) 

1110 prev_aggr = curr_aggr; 

1111 curr.aggr = curr_aggr->next; 

1112 j 
1113 

1114 if(curr_aggr != NULL) | 

1115 /* Match found : update in place, move to front. */ 

1116 curr_aggr->aggr_varO++; 

1117 curr_aggr->aggr_var1 += unpack_var_offset_3; 

1118 curr_aggr->aggr_var2 = ( curr_agg->aggr_var2 >= unpack_var_ttl_3 ? 

1119 curr_aggr->aggr_var2 : unpack_var_ttl_3 ); 

1120 curr_aggr->aggr_var3 = ( curr_agg->aggr_var3 <= 

1121 unpack_var_destIP_3 ? curr_aggr->aggr_var3 : unpack_var_destIP_3 ); 

1122 if(prev_aggr != NULL) 

1123 prev_aggr->next = curr_aggr->next; 

1124 if(t->aggr_head != curr_aggr) 

1125 curr_aggr->next = t->aggr_head; 

1126 t->aggr_head = curr_aggr; 

1127 jelsej 

1128 /* No match found... */ 

1129 if(t->n_aggrs == t->max_aggrs) j 

1130 /* And the aggregate list is full. Reclaim from the end */ 

1131 if(prev_aggr != NULL) 

1132 curr_aggr = prev_aggr->next; 

1133 else curr.aggr = t->aggr_head; 

1134 if(prev_aggr != NULL) 

1135 prev_aggr->next = curr_aggr->next; 

1136 if(t->aggr_head != curr_aggr) curr_aggr->next= 

1137 t->cggr_head; 
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FIG. 1 1 C ( continued) 

t->aggr_head = curr_aggr; 

/* Create an output tuple for the aggregate being kicked out */ 

tuple_size = sizeof( struct count_pkts_ tuple); 
tuple = allocate_tuple(f ) t->f.stream_id, tuple_size ); 
if( tuple != NULL) j 

tuple_pos = sizeof( struct count_pkts_ tuple); 

tuple->tuple_varO = curr_aggr->gb_var0; 

tuple->tuple_var1 = curr_aggr->gb_var1; 

tuple->tuple_var2 = curr_aggr->aggr_var0; 

tuple->tuple_var3 = curr_aggr->aggr_var1; 

tuple->tuple_var4 = curr_aggr->aggr_var2; 

tuple->tuple_var5 = curr_aggr->aggr_var3; 

posLtuple(tuple); 

i 

jelsej 

/* Room in the aggregate list, add another block. */ . 

curr_aggr = (struct count_pkts_aggr_struct *) 
fta_alloc(f,sizeof(struct counLpkts_aggr_struct) ); 

if(curr_aggr NULL) return(O); 

curr_aggr->next = t->aggr_head; 

t->aggr_head = curr_aggr; 

t->n_aggrs++; 

i 

curr_aggr->gb_varO = gb_attr_0; 
curr_aggr->gb_var1 = gb_attr_1; 
curr_aggr->aggr_varO = 1; 
curr_aggr->aggr_var1 = unpack_var_offseL3; 
curr_aggr->aggr_var2 = unpack_var_ttl_3; 
curr_aggr->aggr_var3 = unpack_var_destIP_3; 

i 

return 0; 
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FIG. 11 D 



1101 struct FTA * counLpkts_fta_alloc(unsigned stream. id, unsigned priority, int 

1102 argvc, void * argv[] ) \ 

1103 struct count_pkts_fta* f; 
1104 

1105 if( (f=fta_alloc(0,sizeof(struct count_pkts_fta) ) )==0) j 

1106 return(O); 

1107 j 

1108 f->aggr_head = NULL; 

1109 f->n_aggrs - 0; 

1110 f->max_aggrs = 1; 
1111 

1112 f->f ,stream_id=stream_id; 

1113 f->f.priority=priority; 

1114 f->f.alloc_fta=count_pkts_fta_alloc; 

1115 f->f.free_fta=free_fta; 

1116 f->f .control_fta=control_fta; 

1117 f->f .accept. packet=accept_ packet; 
1118 

1119 return (struct FTA *) f; 



1120 
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FIG. 12 

DEFINE | 

fta_name 'tesLquery'; 
I 

select hdrjength, max( strJind_substr(IPv4_header, 'bob') ), 
str_find_substr( min(IPv4_header) /bob') 

from IPV4 p 

where precedence > 5 and IPv4_ header > 

str_find_substr(IPv4.data, 'hosfcV) 
group by hdrjength 



FIG. 13 

DEFINE j 

fta_name 'counLpkts'; 
min_hdrjength Mnt*; 

select timestamp, hdrjength 
from IPV4 p 

where hdrjength > $min_ hdrjength 
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FIG. 14A 
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^include "rts.h" 
jjfinclude "fta.h" 



/* The FTA references the following internal fens: 

7 

struct count_pkts_fta j 
struct FTA f; 

int param_min_hdr_length; 

I; 

struct count_pkts_ tuple | 

unsigned long long int tuple_varO; 
unsigned int tuple.varl; 

static void load_params(struct count_pkts_fta H, int sz, void *value) | 
int pos=0; 
int data_pos; 

data.pos = sizeof( int ); 
if(data_pos > sz) return; 



t->param_min_hdr_length = *( (int *) ( (char *)value+pos) ); 
pos += sizeof( int ); 



static int free_fta(struct FTA *f) \ 
return 0; 

i 
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FIG. 1 4A (continued) 



1 134 static int control. fta(s true t FTA *f, int command, int sz, void *value) j 

1135 struct count_pkts_fta * t = (struct count_pkts_fta *) f; 
1136 

1137 if(command " FTA„ CO M MAN D_ L0AD_ PARAMS) j 

1138 load_params(t, sz, value); 

1139 j 

1140 return 0; 

1141 \ 
1142 

1143 static int accept. packet(struct FTA *f, struct packet *p) j 

1144 /* Variables which are always needed */ 

1145 int retval, tuple_size, tuple_pos; 

1146 struct counLpkts_ tuple Huple; 

1147 struct count_pkts_fta *t = (struct count_pkts_fta*) f; 
1148 

1149 /* Variables for unpacking attributes */ 

1150 unsigned int unpack_var_hdr_length_3; 

1151 unsigned long long int unpack_var_timestamp_3; 
1152 

1153 

1154 /* Unpack the referenced fields */ 

1155 retval = get_ipv4_hdrjength_(p, &unpack_var_hdr_length_3); 

1 156 if (retval) return 0; 

1157 retval = geLtimestamp(p, &unpack_var_timestamp_3); 

1 158 if (retval) return 0; 
1159 
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l % Test the predicate */ 

if( !( ( unpack_var_hdr_length_3>t->param_min„hdr„length ) ) ) 
return 0; 

/* Create and post the tuple */ 

tuple_size = sizeof( struct count_pkts_ tuple); 
tuple = allocate. tuple(f f t->f.stream_ id, tuple_size ); 
if( tuple == NULL) 
return 0; 

tuple_pos = sizeof( struct count. pkts_ tuple); 
tuple— >tuple_var0 = unpack_var_timestamp_3; 
tuple->tuple_var1 = unpack_var_hdr_length_3; 



i 



posLtuple(tuple); 
return 0; 



struct FTA * count_pkts_fta_alloc(unsigned streamjd, unsigned priority, int 
command, int sz, void *value) \ 
struct count_pkts_fta* f; 

if( (f=fta_alloc(0,sizeof(struct count. pkts_fta) ) )==0) } 
return(O); 



f->f.stream_id=stream_id; 

f->f.priority=priority; 

f->f.alloc_fta=count_pkts_fta_alloc; 

f->f.free_fta=free_fta; 

f->f.controLfta=control_fta; 

f->f.accept_packet=accept_packet; 



load_params(f, sz, value); 
return (struct FTA *) f; 



